Overview

overview

10

Static

static

10

138ab3d712...91.exe

windows7-x64

10

138ab3d712...91.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

  • Size

    3.1MB

  • MD5

    097568748bb3dc42a29f6982d1fc4ac3

  • SHA1

    b7e45e9dd14adc29d59eca162c57d747ad229fcb

  • SHA256

    138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

  • SHA512

    22ecd01b0534718b19d9af0bf369184c8e703e7ad76ef6ed49f7168d1ede3f512311aca9ce5de2b32cac016377bf84529f5b05a26b88c85bb303142445cf3698

  • SSDEEP

    49152:3vXI22SsaNYfdPBldt698dBcjH0tk+GoGZyTHHB72eh2NT:3vY22SsaNYfdPBldt6+dBcjHEk1

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

81.161.238.80:4444

Mutex

4e2e78da-feaf-429e-aac4-9ee8a177bbf1

Attributes
  • encryption_key

    F67E99F78BCB3DE5163C575051A85C1166CAAB55

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.